CVE-2024-28571

What it actually does

Buffer overflow in FreeImage 3.19.0 fill_input_buffer() during JPEG image parsing allows local denial of service.

Why it matters to the business

Image-processing workloads on AlmaLinux 8 may crash when handling crafted JPEGs, causing application downtime; the affected selinux-policy packages are broadly deployed.

How an attack unfolds

A local attacker supplies a malicious JPEG to any process using the vulnerable FreeImage library; the overflow occurs inside fill_input_buffer() and terminates the process.

How to fix it

Upgrade selinux-policy, selinux-policy-devel, selinux-policy-doc, selinux-policy-minimum, selinux-policy-mls, selinux-policy-sandbox and selinux-policy-targeted on AlmaLinux 8 to 3.14.3-95.el8 or newer.

How to confirm the fix worked

Confirm installed package versions match or exceed 3.14.3-95.el8 and test JPEG processing with known-good and boundary-case images.

Typical attack path

1. Locate an application or service that uses FreeImage to read JPEG files
2. Prepare a JPEG image crafted to overflow the input buffer
3. Trigger image loading via the target application or API call
4. Cause process crash and denial of service

How to detect it

Review application and system logs for unexpected terminations while processing JPEG images; correlate with process crash dumps or core files.

What your security team should do

• Apply the listed AlmaLinux 8 package updates without delay
• Inventory services that depend on FreeImage or the selinux-policy stack
• Add JPEG parsing to crash-monitoring and restart policies